Information Management Assessment

A review of good practice from the IMA programme, 2008-16

Section 1: The value of information Contents

1 Communicating and realising value 3

Telling staff why information matters Management support Setting goals for information and its management Enabling public access to information and supporting transparency and re-use

2 Managing, protecting and exploiting information assets 12

Defining and cataloguing information assets The role of the information asset owner

Note: references are to the named individuals, roles and organisations as they operated at the time of the Information Management Assessment or progress review

© Crown copyright 2016.

OGL

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk

1. Communicating and realising value

IMA Goal: The organisation establishes information's value in principle and supports its realisation in practice.

**Telling staff why information matters**

Good information and records management doesn’t happen by itself. While IT systems can help by automating and simplifying processes, staff will still need to exercise judgement and invest an amount of time and effort to get things right. The first step in helping staff do this is ensuring that the value of information is understood.

Our assessments consider how clearly the value of information is set out in corporate policy and guidance.¹ We look to see whether legal obligations are established and how actively the business benefits of good practice are being conveyed.

**Welsh Government, 2014 IMA**

The policy and guidance we reviewed emphasised the need to adhere to best practice principles for information and records management, to store information correctly and to share it appropriately and effectively. Information management policy noted the need to manage information to agreed standards so it could be understood and used in the future. The 2014 IMA report noted:

‘Welsh Government has divided its intranet, Connect, into 11 main sections, one of which has been allocated to information. This clearly demonstrates its significance. The information section covers protecting as well as managing and exploiting information and knowledge, with documentation gathered in a single place rather than distributed separately under different functional headings.’

¹ [nationalarchives.gov.uk/information-management/manage-information/ima/](http://nationalarchives.gov.uk/information-management/manage-information/ima/) The first page in the Information section within Connect provides the following headline statement for staff on the value of information:

‘The knowledge and information we hold is one of our most important assets. It ensures that the decisions we make and the advice we give is based on a robust bank of evidence. Managing and protecting this information – particularly if it is sensitive or personal – is an important part of our role as civil servants.’

Department of Health, 2014 IMA

Information management and information assurance policies had been written and positioned to deliver consistent messaging to staff. The information management policy had been personally endorsed by the then Permanent Secretary, Una O’Brien. The IMA report noted:

‘In her foreword, she states that adoption of the policy will support achievement of the department’s key objective of public accountability, enable greater effectiveness and efficiency, and underpin efforts to transform the department. Further highlighted benefits within the policy include improved ability to deliver transparency and open data goals. It establishes the department’s commitment to good practice in information and records management as a central component of business strategy. It also establishes the responsibility that staff have, both for managing information and for preserving, protecting and sharing it.’

Management support

Once key principles are established in policy, organisations need to ensure that they are adopted in practice. To achieve this, organisations need the backing of managers at all levels within the chain of command. The Section 46 Code of Practice recommends the identification of a member of staff of sufficient seniority to act as a champion for information and records Sir Alex Allan emphasised the need to back up policy and guidance with a high-level push in his 2015 *Review of Government Digital Records*. He noted that sustained and co-ordinated top down support and encouragement should be provided. The cross-government records management project set up in response to Sir Alex Allan’s report is currently providing support to government departments on how best to enable this and achieve a supportive culture.

**Foreign & Commonwealth Office (FCO), 2014 IMA reassessment**

Our 2014 IMA reassessment noted the visible priority that FCO was attaching to information and records management. This was evident both from the explicit emphasis given to the subject in the annual reports and accounts and departmental improvement plans, and from the appointment of the Chief Operating Officer (COO) as Board-level champion.

The IMA report noted that the COO had been active in supporting the department’s knowledge strategy, promoting the importance of good practice and sponsoring key communications. In a message to staff published ahead of the IMA, the COO emphasised knowledge management as one of the FCO Board’s current top corporate priorities, stating:

‘We create a vast amount of information every day, from political reporting and policy submissions, to our engagement with the public and businesses. Sharing this information effectively, and making sure we can retrieve what we need, when we need it is an essential part of all of our jobs.’

______________________________________________________________________

2 [nationalarchives.gov.uk/information-management/manage-information/planning/records-management-code/](http://nationalarchives.gov.uk/information-management/manage-information/planning/records-management-code/)

3 [www.gov.uk/government/publications/government-digital-records-and-archives-review-by-sir-alex-allan](http://www.gov.uk/government/publications/government-digital-records-and-archives-review-by-sir-alex-allan) HM Treasury, 2015 IMA

Senior support for information and records management in HM Treasury was among the best we have seen. Our report noted:

‘The Second Permanent Secretary, John Kingman, is the Senior Sponsor for Knowledge and Information Management (KIM) within HM Treasury. He is personally involved with the Knowledge Management Benchmarking [the department’s KIM performance-monitoring process], including presenting awards to top performers and meeting with the directors and deputies of low-scoring business areas that need to improve practice. He was instrumental in refreshing the KIM unit and identifying new KIM leadership, and interviewees reported that he is keen to lend his name to and support KIM messages.’

The House administrations, Houses of Parliament, 2016 IMA

The enabling roles that senior staff and managers should be fulfilling were clearly set out by the House administrations, providing a firm basis for future engagement:

‘The Parliamentary Information and Records Management Policy sets clear expectations for line managers and for heads of department/office. The latter are broadly responsible for strategic oversight and ownership of related risk, while the former are expected to ensure staff are aware of their responsibilities and, just as importantly, are given sufficient time available to carry out required tasks.’ Department for Environment, Food and Rural Affairs (Defra), 2013 progress review

At the time of its progress review, Defra had carried out a review of the roles that supported and enabled information and records management. Following the review, Defra sought opportunities to engage managers and raise the profile of the roles and underline the importance of their work. The progress review noted:

‘Roles will be re-launched at an [information and knowledge management] themed conference in January 2014. This is targeted at senior leads and intended as a platform to underline the benefits of good practice and … kick off a programme of learning and development activities aimed at up-skilling staff in the Business that will take place throughout the year.’

Setting goals for information and its management

An endorsed and supported information strategy is a key tool for driving increased capability and improved performance.

To be effective, any strategy must be actively adopted. Information strategies should be comprehensive, time bound, agreed at a senior level and easily communicated. They should also be regularly reviewed and should be accompanied by defined milestones and a detailed implementation plan. The goals set by an organisation should be aligned in support of overarching business objectives.

We recommend establishing a holistic, joined-up vision for the management, protection and exploitation of information. If relevant goals are established through separate strategies, these should be explicitly linked and the relationship between them should be defined. It is particularly important that organisations recognise the relationship between IT and information and records management objectives. A supportive IT environment makes it easier to achieve information and records management outcomes. At the same time, good information and records management practice makes it more likely that expected benefits will be realised from existing or newly introduced IT systems.

**Ministry of Defence (MOD), 2011 IMA**

The significance of the MOD Information Strategy (MODIS) was underlined by its publication on the department’s internet pages and by prominent senior-level endorsement from the Permanent Under-Secretary of State and the Vice Chief of Defence Staff. The IMA report noted:

‘MODIS establishes the Defence Information Vision and its status as an enabler of the main Defence Vision. It clearly establishes information as a strategic asset and the critical need for the department to transform the way it exploits it.’

**Foreign & Commonwealth Office IMA reassessment (FCO), 2014 IMA**

Knowledge management was one of the five strands of the FCO IT strategy – the most effective example of a joined-up approach we have yet found. This set the clear aim of enabling better KIM through the introduction of an improved IT environment. The IMA report noted:

‘Its introduction represents a fundamental shift for the department and is one of the most significant developments since the previous IMA. The fourth “Knowledge Excellence” strand is integrated alongside the other IT-focused elements, providing what one senior interviewee described as “an opportunity to bring knowledge to the fore through IT”. This joined-up approach and the explicit alignment of Knowledge Excellence in support of the wider Diplomatic Excellence programme is best practice.’ Department for Business, Innovation and Skills (BIS), 2013 IMA

The BIS IMA report commended the department for drafting a KIM strategy with the aim of reaching a point where ‘KIM is not an added task, it is how we work’. The IMA report noted:

‘The draft BIS Knowledge and Information Management strategy has the potential to act as a key driver for change, once endorsed and signed off. The draft strategy is aligned to the Information Principles for UK Government and establishes the importance of improving how knowledge is shared and how the value of information is understood and realised. It underlines the benefits of good practice in information management in terms of business outcomes, and in terms of compliance with department’s obligations under information legislation and the government’s transparency agenda.’

Department for Communities and Local Government (DCLG), 2014 progress review

DCLG had no information strategy in place at the time of its 2012 IMA. Following the IMA, it produced an Electronic Records Handling Strategy. This was jointly approved by the Departmental Records Officer (DRO) and Chief Information Officer (CIO) in 2014. It identified key objectives for information held in shared and personal drives, mailboxes and the department’s near-line electronic records repository, VISIONS. The department also produced a separate Knowledge Management Strategy that was agreed by the Senior Information Risk Owner (SIRO) in December 2014. The progress review noted:

‘This gives DCLG a set of high-level endorsed strategic aims and outcomes above the level of the Electronic Records Handling Strategy, towards which work by KIM, IT and information assurance teams can be aligned. This makes it easier for DCLG to achieve co-ordinated

______________________________________________________________________

4 www.gov.uk/government/uploads/system/uploads/attachment_data/file/266284/Information_Principles_UK_Public_Sector_final.pdf improvements in the management, protection and exploitation of its information. It also means that the Electronic Records Handling Strategy can be positioned as a key enabler of the overall Knowledge Management Strategy.’

Enabling public access to information and supporting transparency and re-use

Information has value inside and outside organisations. Good practice in information and records management supports and enables the effective and appropriate exploitation of information for the public benefit – something that should be a key objective of any public sector organisation. Government organisations should seek to realise the value of the information they hold by publishing it, licensing it for re-use and enabling public access. We consider whether organisations are working proactively to maintain and improve their performance in this area.

From a practical point of view, we assess whether organisations have effective approaches in place for responding to Freedom of Information (FOI) requests and the extent to which there is a joined-up approach in place for transparency, open data and enabling access to information.

Department for Work and Pensions (DWP), 2014 IMA

Despite the sensitivity of much of its information, DWP was striving to proactively publish as much data as possible; we recognised that it had made real progress in this area. It also had a well organised system for FOI with a consistently high level of performance evident, although it received some of the highest volumes of requests within government. The IMA report noted:

‘Requests are logged and tracked using a workflow system, records of the process are kept and retention is built in. The central FOI and Data Protection teams provide advice, guidance and support to FOI Focal Points, DPOs and Deputies via the intranet and through regular telekits or video conferencing sessions. The central teams are also looking at innovative ways of extending their reach, for example, FOI Focal Points have a virtual team and the Data Protection team are helping DPOs to help each other by setting up mentoring sessions …

‘There is recognition of the potential tensions between transparency and security and these two areas are together under one Director General Command. DWP has established a Welfare Sector Transparency Board (WSTB). This is external facing and includes financial people from work programme contracts and representatives from blue chip companies. All records of this group are published. There is also an Open Data Working Group which sits underneath the WTSB and includes representatives from their main consumer groups. This group helps DWP to understand what consumers of their information want and understand their priorities as well as acting as a forum to discuss what they can do better as an organisation and where changes can be made.’

The Environment Agency, 2009 IMA

The 2009 Environment Agency IMA report noted that the agency licensed a significant amount of its information to the business sector, the legal sector and the general public. The IMA report noted:

‘The Agency developed an "Approved for Access" programme to pre-assess categories of information it held; for example, spatial flood risk maps. Categories of data and information that did not have such confidentialities could then be provided to the customer without further consideration.’ 2. Managing, protecting and exploiting information assets

IMA Goal: The organisation manages, protects and exploits its information assets to achieve maximum value.

Defining and cataloguing information assets

Government organisations must have mechanisms and processes in place to ensure information assets are properly classified and appropriately protected.(^5) If used effectively, the concept of an information asset provides a key means of enabling outcomes for the management and exploitation of information as well as its protection.

Guidance on the mandatory role of Information Asset Owner (IAO) defines an information asset as:

‘A body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited effectively. Information assets have recognisable and manageable value, risk, content and lifecycles.(^6)

We look at how organisations interpret this definition, encouraging them to apply it in a proportionate manner to unstructured as well as structured information. Information Asset Registers should be maintained and actively used. They should allow IAOs to record key context about their information assets, including location, content, format, value and retention requirements as well as purely security related considerations.

______________________________________________________________________

(^5) [www.gov.uk/government/publications/security-policy-framework](http://www.gov.uk/government/publications/security-policy-framework)

(^6) The role of IAO was established as mandatory following the 2008 Data Handling Review [www.gov.uk/government/uploads/system/uploads/attachment_data/file/365742/Guidance_on_the_IAO_Role.pdf](http://www.gov.uk/government/uploads/system/uploads/attachment_data/file/365742/Guidance_on_the_IAO_Role.pdf) UK Export Finance (UKEF), 2015 progress review

We noted that UKEF had put considerable effort into updating its Information Asset Register since its 2013 IMA to make this a more useful tool for the management of information assets, adding key context including retention.

The progress review noted:

‘The department has moved away from just listing IT systems as information assets. It now has a much more detailed understanding of its information assets and asset clusters, which have been identified and catalogued. In pulling together the updated register the KIM team has visited all Information Asset Owners (IAOs). There have also been workshops, including one from The National Archives’ Information Assurance and Cyber Security Programme (IACSEP), to train them on the IAR and their responsibilities around this.’

The National Archives, 2012 progress review

We assessed our own organisation in 2011. The 2012 progress review noted that information assets were now logged within an Information Asset Profile. This was established as a framework to enable the management, protection and exploitation of our information assets.

We identified this as a practical and pragmatic approach. Information assets were defined on the basis of disposal schedules and unstructured information was included as a matter of course:

‘Sample reporting summaries indicate that IAOs are required to provide assurance on a range of issues including application of retention. The model adopted is department specific, building on and exceeding Cabinet Office minimum requirements … As well as raising risks, IAOs are being asked to report on any steps they have taken to support transparency and detail efforts to increase the sharing potential of information assets.’ The House administrations, Houses of Parliament, 2016 IMA

The House administrations set up a specific project to increase understanding of information held by business areas.

‘The Information Ownership Project has introduced a template Information Asset Register that allows key context to be captured for each documented information asset including purpose, storage location and disposal. There are brief pointers under each heading to guide those populating with questions such as “Who has access to the information? How is access controlled? …”

‘Workshops have been held to encourage teams to think about how information flows between them. The creation of Information Asset Registers has encouraged some teams to rethink the sensitivity of their information assets and has resulted in new disposal schedules being defined.’

Northern Ireland Office (NIO), 2016 IMA

Business areas were expected to populate an Information and Data Asset Register (IDAR). We were able to view sample IDARs and concluded that, if all were populated in the same manner, the SIRO would receive the assurance they required. The IMA report noted:

‘We were provided with the template prior to the IMA and were able to view two completed examples. Overall, the template is straightforward and includes the headings that we would expect, including business requirements and retention.

‘The completed examples reviewed in this IMA had been populated well. We are particularly pleased to note that proportionate groupings of unstructured information have been identified as information assets, rather than just listing assets at a system level or those that contain personal data.’ The role of Information Asset Owners (IAOs)

We look at the level at which IAOs are appointed and how they are trained and supported. We also consider whether organisations are using their IAOs as conduits for encouraging good practice.

IAOs should formally review risks to the confidentiality, integrity and availability of their information assets at least once a year, providing assurance on their security and use. In order to meet the requirements of the Security Policy Framework, IAOs are expected to:

- lead and foster a culture that values, protects and uses information for the public good
- know what information the asset holds, and what enters and leaves it and why
- know who has access and why, and ensure their use of the asset is monitored
- understand and address risks to the asset, and provide assurance to the SIRO
- ensure that the asset is fully used for the public good, including responding to access requests.

Department for Work and Pensions (DWP), 2015 IMA

We found that DWP had a good process in place for reporting on, and oversight of, information assets via an Information Asset Inventory (IAI) and the Information Asset Assurance Returns. The IMA report noted:

'The IAO role has been refreshed and relaunched as a Business Senior Information Risk Owner (BSIRO) and there was good practice around the Information Asset Co-ordinator role and in establishing and maintaining good networks of Information Asset Managers. There have

7 www.gov.uk/government/uploads/system/uploads/attachment_data/file/365742/Guidance_on_the_IAO_Role.pdf been real attempts to incorporate information and records management into this process by including retention information on the IAI and a question on the Information Asset Assurance Returns around compliance with the Records Management Policy.’

**Criminal Records Bureau (CRB), 2012 IMA**

The IMA report highlighted how the agency had worked to empower its IAOs with a sense of ownership and responsibility:

‘The Senior Information Risk Owner (SIRO) effectively delegated responsibility for management of risk to Information Asset Owners (IAOs) through the creation of an engaged network with support structures … IAOs have quarterly meetings with the SIRO, complete quarterly returns, update the Information Asset Register (IAR) and are assigned administrators. Quarterly meetings actively engage individuals, with IAOs talking about their information assets and sharing best practice. IAOs reported feeling supported by the structure and IAO network, and the provision of administrative support demonstrated the recognition by CRB about the importance of the role.’

**The Ministry of Justice (MOJ), 2016 IMA reassessment**

Our report noted that MoJ had been actively engaged with The National Archives’ work on information assurance and risk:

‘The National Archives ran a number of bespoke “train the trainer” sessions for MoJ staff in October and December 2015 and March 2016. The IAO Workshops have been running in-house since November 2015. These workshops have been continued to be run very successfully by the [Central Information Assurance Branch] team since April 2016, and the team continue to engage with The National Archives to ensure that their approach is robust and guidance and briefing materials are comprehensive and up-to-date. MoJ plan to continue this work and plans are in place to increase the number of staff trained in delivering the training and to maintain a pool of presenters and trainers for the workshops.'